52b3a80c28a492eca1ce47570d5e443598944a050b194a5c5b46bb41457cf0a6

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
18/03/2024, 14:51

Target

inject.dll
Size

20KB
MD5

ba22aa6f9c720ee25c8aa3ff54b68e01
SHA1

f1f2721afb45ab379ad1de06233ea6e7972c8af3
SHA256

59953830d6fa2d5306e0aa4a20b74b588c9179f10247f680ffba2e8bd025f49f
SHA512

7ce0fb95ff5f056415502a04e5b966c0c758b0955aef39c784459798e4ef5c3fb549efdf070df76ccbd7de25491c7ed35d50694e5fed7703e869ae08c4ace3bb
SSDEEP

384:xXuiWO48f+Z8N8p/ij7m+1I39giJbBw43rOGIfjZDMC821L/LoO2G2bDz7Wm:RF4hZ1p/ija+1ItpywSzjxMqZzoO27C

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1840	rundll32.exe
1840	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2920 wrote to memory of 1840	2920	rundll32.exe	28
PID 2920 wrote to memory of 1840	2920	rundll32.exe	28
PID 2920 wrote to memory of 1840	2920	rundll32.exe	28
PID 2920 wrote to memory of 1840	2920	rundll32.exe	28
PID 2920 wrote to memory of 1840	2920	rundll32.exe	28
PID 2920 wrote to memory of 1840	2920	rundll32.exe	28
PID 2920 wrote to memory of 1840	2920	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\inject.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\inject.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1840